#!/usr/bin/env python3
"""Rebuild thesaurus.md with file:line occurrences in in-scope repos."""

from __future__ import annotations

import subprocess
from pathlib import Path

ROOT = Path("/Users/marchon/research")
OUT = Path("/Users/marchon/research/system-git-sync/docs/thesaurus.md")
SCOPE = [
    "system-git-sync",
    "nats-service-endpoints",
    "secure-messaging",
    "peergos-for-compliance",
    "peergos-for-compliance-admin",
    "peergos-for-compliance-ipfs",
    "peergos-for-compliance-replication",
    "peergos-compliance-docs",
    "peergos-compliance-architecture",
    "peergos-compliance-go",
    "peergos-compliance-config",
]
# Canonical term, banned phrase, grep needle for "use this"
TERMS = [
    ("Untrusted broker", "NATS", "secure bus", "untrusted"),
    ("Production E2E", "NPE / HPKE", "TLS to NATS", "NPE"),
    ("Lab envelope", "pfc-lab-xor", "xor cipher", "lab-xor"),
    ("Dest in clear", "passthrough", "plaintext message", "passthrough"),
    ("Sender handle", "lookup_id", "from username on wire", "lookup_id"),
    ("Config file", "signed wrapper", "raw JSON config", "signed wrapper"),
    ("Admin audit", "DataCube admin-history", "SQL log", "admin-history"),
    ("Failure to sender", "ct_sender", "email bounce plaintext", "ct_sender"),
    ("Ops bounce", "ct_system / Network Error Bundle", "log the ciphertext body", "ct_system"),
    ("Inspect officers", "share names", "Google accounts", "k-of-n"),
    ("Console SSO", "PFC TOTP/Google", "Peergos Drive login", "PFC_REQUIRE_AUTH"),
    ("NPE sidecar", "npe seal --to", "HPKE in Python", "npe_adapter"),
    ("Review gate", "cicd/GATE.md", "auto-deploy to ns1", "GATE.md"),
    ("sm-leaf health", "GET 127.0.0.1:18783/health", "WAN NATS ports", "18783"),
]


def hits(needle: str, limit: int = 8) -> list[str]:
    cmd = [
        "rg",
        "-n",
        "--glob",
        "!**/{build,.git,node_modules,__pycache__,bin}/**",
        "-g",
        "!*.pyc",
        needle,
    ]
    paths = [str(ROOT / s) for s in SCOPE]
    p = subprocess.run(cmd + paths, capture_output=True, text=True)
    lines = [ln for ln in (p.stdout or "").splitlines() if ln.strip()]
    out = []
    for ln in lines[:limit]:
        if ":" in ln:
            out.append(ln.replace(str(ROOT) + "/", "")[:160])
    return out


def main() -> None:
    rows = [
        "# Thesaurus",
        "",
        "Canonical term → where it lives. Occurrences are grepped from in-scope",
        "repos (docs **and** code). Banned phrases must not be used as the name",
        "of the thing.",
        "",
        "This is **not** a HIPAA/SOC 2/ISO certificate.",
        "",
        "| Term | Use this | Not this | Occurrences |",
        "|---|---|---|---|",
    ]
    for term, use, banned, needle in TERMS:
        occ = hits(needle)
        cell = "<br>".join(f"`{x}`" for x in occ) if occ else "_(none)_"
        rows.append(f"| {term} | {use} | {banned} | {cell} |")
    rows += [
        "",
        "## Certification",
        "",
        "In-scope documentation uses the **Use this** column. `passthrough`",
        "means destination in the clear, not a plaintext message body.",
        "NATS is the untrusted broker. Production E2E is NPE/HPKE.",
        "",
    ]
    OUT.write_text("\n".join(rows) + "\n")
    print("wrote", OUT)


if __name__ == "__main__":
    main()